RSA Solution Brief. Managing Risk Within Advanced Security Operations. RSA Solution Brief

RSA Solution Brief Managing Risk Within Advanced Security Operations RSA Solution Brief

How do you advance your security operations function? Increasingly sophisticated security threats and the growing challenge of compliance mean that organizations must take a different view of security operations management. The traditional approach to security operations, centered almost exclusively on security information and event management (SIEM), is now evolving. SIEM is still the key evidence collector, but today's advanced security operations programs are founded on a flexible egrc (enterprise governance, risk and compliance) platform that integrates SIEM, data loss prevention, threat intelligence and other key technologies from the IT operations function. Together, these capabilities provide an integrated framework for protecting critical resources and achieving compliance through comprehensive incident detection, response and remediation. With the appropriate enabling technologies in place, your security operations team is able to move quickly to identify suspicious activity or weaknesses in your security infrastructure; to respond to incidents swiftly and take steps to limit damage; and to analyze and report on events for the purposes of compliance and improving security across your organization. Managing Advanced Security Operations Within Your Organization To keep pace with the constant evolution of threats and compliance obligations, security operations teams need a comprehensive and sustainable framework for monitoring security events in real time and delivering intelligence to both anticipate and respond to incidents. Traditionally this has meant security operations centered on SIEM. But for many organizations, a new view of security operations is emerging: one that centers on defining a process, followed by selecting an appropriate technology framework to support the operation, supplemented by supporting tools. SIEM remains a key element of the security backbone, but needs to be coupled with an egrc platform to support the underlying security operations framework. By integrating capabilities from the broader security organization, and those found within the IT operations environment, security operations is able to establish a much more robust and sustainable program. These organizations view security operations as effectively combining a set of core capabilities, both strategic and tactical, that are central to effective risk and IT compliance management. In addition, this next generation of security operations requires coordination across numerous systems many of which have not traditionally supported the security operations function. By coordinating and integrating all these functions, organizations have a better ability to handle incidents the overriding priority of an advanced security operations function. And although it can be managed as an independent activity, integrating incident handling with other security and IT functions enables swifter responses and more accurate and complete intelligence. The result is better support given to other business functions, such as Legal, and more effective compliance. So where do you turn for solutions that will facilitate this integrated approach and help you protect against the security threats to your business? RSA can help you to create an advanced security operations function from the ground up, or evolve your existing operations. RSA and EMC solutions for advanced security operations combine expertise within our consulting and advisory services team with our proven technology platforms to establish your nextgeneration security operations program. We equip you to effectively identify, manage and report on information risk across your organization, and give you the controls you need to adapt easily to the everchanging landscape of IT compliance. 1 RSA Solution Brief

An advanced security operations program will give you the visibility and real-time intelligence to act quickly in the event of an incident and, more importantly, identify and understand vulnerabilities early enough to prevent incidents from happening in the first place. RSA solutions for advanced security operations deliver essential services and technology capabilities that help you to: Plan and develop your security systems and processes Define metrics for measuring and reporting Define team requirements Establish work flow processes Enact and test business continuity plans Monitor and manage your infrastructure Identify hardware and software failures relevant to the security infrastructure Identify vulnerabilities affecting the IT infrastructure Ensure that IT infrastructure component configuration meets policy Correlate and analyze security inputs from multiple sources Manage changes in key elements of the security infrastructure Manage user access Manage and respond to security incidents and events Identify potential security events in real time Provide immediate alerts regarding potential attacks Identify and execute basic remediation Drive more complex remediation through IT teams (such as the NOC) Monitor the effectiveness of security devices (e.g., IPS, IDS) Understand and manage emerging vulnerabilities Provide a real-time view into a network s security posture Identify hosts and resources affected by a security incident Integrate security events with incident response systems Identify and respond to both network and host-based attacks Ensure efficient and prioritized incident response Report on incident remediation status Enforce and validate compliance Take a strategic view of security operations Investigate security incidents Identify trends to plan future remediation Drive internal awareness of security posture and policy Identify security areas needing improvement Create a sustainable framework for an advanced security operations program RSA Solution Brief 2

Integrated Solutions for Advanced Security Operations RSA Consulting and Advisory Services Service Benefit RSA brings together a comprehensive set of consulting and advisory services and IT security technologies to help you define, establish and manage an advanced security operations function. With RSA, you can take advantage of: Strategic consulting and design services that will identify requirements and help you develop a comprehensive security operations program Market-leading IT security technologies, including the RSA Archer egrc platform, the RSA envision platform and the RSA Data Loss Prevention Suite, that form your core security operations program Security Operations Strategy & Assessment Security Operations Analysis and Design Security Operations Management Strategic assessment and recommendations based on security best practices Tailored plans for enhancement or implementation of an organization s security operations Consultation centered around operational requirements Cutting-edge services, such as the RSA FraudAction SM Threat Intelligence, that can help you stay ahead of emerging threats Integration with network operations technologies, such as change and configuration management and IT service desk, from RSA, EMC, VMware and our partners, to enhance the capabilities of the security operations function RSA Consulting and Advisory Services RSA offers a complete range of services that can be tailored to meet the needs of your organization, whether to address a specific situation or create an end-to-end security framework. The RSA Professional Services organization has the expertise to help you achieve measurable improvements in your security operations that align with your business objectives. We work closely with your stakeholders to devise the technology solutions and processes that will protect your information resources, enterprise wide. Security Operations Strategy & Assessment is appropriate for customers with established security operations processes, or who are establishing new security operations processes, and wish to advance their capabilities based on industry best practices and current-state gap analysis, providing an actionable set of vendor- and product-agnostic recommendations. Security Operations Analysis & Design is appropriate for customers who want a broad evaluation of security operations requirements and a recommended solution design to meet their objectives for security operations and incident management. It also includes an incident-handling framework and next steps for the development of appropriate policies and procedures for security operations. We will help you develop a comprehensive security operations program that's right for your business. 3 RSA Solution Brief

RSA Advanced Security Operations Technology Solutions Solution RSA Archer egrc platform Function Flexible platform that helps security operations teams manage risks, demonstrate compliance, automate business processes, and gain visibility into corporate risk and security controls RSA envision platform Integrated SIEM that serves as the central platform for an advanced security operations program RSA Data Loss Prevention Suite Provides a policy-based approach to securing data that integrates with RSA envision to enable an information-centric approach to security operations RSA FraudAction Threat Intelligence Helps your security operations teams understand the current and emerging threat environment Security Operations Management is appropriate for customers seeking the development of more comprehensive policies, procedures, guidelines and documentation for an advanced security operations function, including operational run-books and workflow that support the ability to run a security operations function or incident-handling program on a day-to-day basis. In addition to RSA Consulting and Advisory Services, the development of an advanced security operations function is supported by a combination of key technologies and solutions from RSA, EMC and our partners. information from other systems, such as RSA envision log management, RSA Data Loss Prevention and the FraudAction service, to create meaningful, real-time intelligence across your whole enterprise. The RSA Archer egrc platform also integrates intelligence on security alerts and threats, streamlines the process of gathering and presenting metrics about the effectiveness of security controls and security management processes, and enables analysis of other contextual information about the security and business environment to help you assess business impact. The RSA Archer egrc Platform The RSA Archer egrc platform serves as the foundation of an advanced security operations function, storing threat and incident data, acting as a platform for managing security incidents, and significantly streamlining business processes around incident response and remediation, in addition to daily security operations tasks. The Platform automatically pulls risk and security-related The RSA envision Platform RSA envision technology is an effective SIEM and log management solution that collects, correlates and retains large amounts of data in real time from any event source and in computing environments of any size. It also generates real-time alerts of high-risk security events to help your organization respond quickly, and provides visibility into the behavioral aspects of users to assist in remediation. RSA Solution Brief 4

Effectively Managing Security Risk The RSA envision platform significantly reduces security operations workloads by using industrystandard vulnerability assessment systems to analyze and rate events based on actual risk versus potential risk. Your organization can gain a real-time view of its security posture across the enterprise, with the ability to see, respond to and report on security events and attacks quickly and more efficiently. RSA Data Loss Prevention Suite RSA Data Loss Prevention technology provides a policy-based approach to securing data. It also integrates with the RSA Archer egrc Platform, providing the ability to identify where sensitive data exists across the enterprise, enforce controls, actively monitor data, alert administrators to any suspicious activity, and report on and audit events to ensure compliance with policy. By monitoring and reacting to suspicious activity that s tied to sensitive data, RSA Data Loss Prevention identifies potential non-compliance events in real time and generate immediate alerts. They also control the transmission of sensitive data across your IT infrastructure: quarantining, deleting, moving or applying rights management to documents that contain private information. 5 RSA Solution Brief

RSA FraudAction SM Threat Intelligence RSA FraudAction Threat Intelligence helps security operations teams understand current and emerging threats. It monitors fraudster communications and identifies hosts and resources that may be under attack, and then takes steps to protect them. Offered as an outsourced service, RSA FraudAction Threat Intelligence helps your organization to support its security operations function and deliver even greater value to the business by minimizing resource investment while deploying a solution quickly. Why Choose RSA Solutions for Advanced Security Operations RSA offers the broadest range of services and technologies necessary to develop a truly advanced security operations function. Ranging from consultative professional services to egrc, SIEM, data loss prevention, and threat intelligence, RSA s expertise and proven technology can help your organization build the advanced security operations capabilities you require. By blending capabilities from EMC and RSA, we are able to deliver comprehensive, integrated solutions that completely address the functional requirements of today s advanced security operations teams, expanding beyond security management to include service desk, server and network configuration, and change management. We will help you improve your security operations capabilities and develop an advanced security operations function that will let you identify and manage information risk more effectively, and respond to threats before they affect your business. RSA Solution Brief 6

RSA is your trusted partner RSA, The Security Division of EMC, is the premier provider of security, risk and compliance solutions, helping the world s leading organizations succeed by solving their most complex and sensitive security challenges. These challenges include managing organizational risk, safeguarding mobile access and collaboration, proving compliance, and securing virtual and cloud environments. Combining business-critical controls in identity assurance, data loss prevention, encryption and tokenization, fraud protection and SIEM with industry leading egrc capabilities and consulting services, RSA brings trust and visibility to millions of user identities, the transactions that they perform and the data that is generated. EMC, EMC 2, where information lives, Archer, RSA, envision, FraudAction and the RSA logo are either registered trademarks or trademarks of EMC Corporation in the United States and/or other countries. All other products or services mentioned are trademarks of their respective companies. ASOGRC SB 1010 www.rsa.com